Exercises — Software testing in embedded — unit tests on host, HIL testing

• (a) HOST — pure arithmetic on an array, no peripheral. ✅
• (b) HIL — latency is real time elapsed between an event and the interrupt service routine (ISR) running; the host mocks time so it cannot measure it.
• (c) HOST — booleans in, enum out, no hardware.
• (d) HIL — noise is an electrical property of the real analog-to-digital converter; a mock returns exactly the number you injected, so it has zero noise. Rule of thumb: if you can feed it inputs as plain numbers and check outputs as plain numbers, it is host-testable.

Line A — ADC1->DR reads a physical hardware register that does not exist on your PC, so the program crashes (or won't even link) on the host. Fix using a HAL seam:

uint16_t v = hal_adc_read(ADC_CHANNEL_1);

Now a mock can supply v on the host. Line B (process) was already pure logic and needs no change.

Logic lines $=1000-120-80=800$. Fraction of the whole file that is logic: $\frac{800}{1000}=0.80=80\%.$ So 80% of the file is the logic you must test hard; the other 20% (driver + glue) is either vendor-tested or trivially thin. If you cover all 800 logic lines you hit the coverage bar comfortably. Meets the target. ✅

Max ADC code $=2^{12}-1=4095$ (this represents the full-scale voltage $3.3\text{ V}$). The conversion is linear — code is proportional to voltage: $\text{code}=\lfloor \frac{V_{\text{in}}}{V_{\text{ref}}}\times 4095\rfloor =\lfloor \frac{1.65}{3.3}\times 4095\rfloor .$ $\frac{1.65}{3.3}=0.5$, so $0.5\times 4095=2047.5$, floor $=2047$. (Half of full scale is code 2047, one below the geometric midpoint because we count from 0.)

Linear map: $\text{pwm}=\lfloor \frac{\text{code}}{4095}\times 1000\rfloor$, then clamp to $[0,1000]$.

• code $4095$: $\lfloor 1000\rfloor =1000$ → hits the cap exactly. Matches the parent note's assert(... == 1000).
• code $2047$: $\lfloor \frac{2047}{4095}\times 1000\rfloor =\lfloor \mathrm{499.87...}\rfloor =499$.

Latency = response time − trigger time: $T_{\text{measured}}=12.563-12.480=0.083\text{ms}=83\mu \text{s}.$ Compare: $83\mu \text{s}<100\mu \text{s}$ → PASS (margin $17\mu \text{s}$). Why the host can't catch this: on the host, time is mocked — the ISR is called by your test harness as a plain function, so "how long until the hardware runs it" has no meaning. Real ISR latency depends on CPU clock, higher-priority interrupts, and cache/pipeline effects that only exist on the real target.

New response time = old + added blocking cost: $6.2+5.0=11.2\text{ms}.$ Deadline is $10\text{ms}$, and $11.2>10$ → FAIL. Old margin was $10-6.2=3.8\text{ms}$ (slack, green in the figure). New margin is $10-11.2=-1.2\text{ms}$ (overrun, red). The margin shrank by exactly the $5.0\text{ms}$ we added. This is a timing regression — HIL exists precisely to catch it.

Host total: $40\times 3\text{ms}=120\text{ms}=0.12\text{s}$. HIL total: $8\times 4\text{s}=32\text{s}$. Ratio HIL : host $=32/0.12\approx 267$. HIL is ~267× slower here. Every logic bug you can catch on the host saves you a ~267×-more-expensive round trip — that is the whole argument for the two-tier strategy.

Seams (mock/stub them):

• hal_adc_read(ADC_TEMP) — a stub you set; returns the injected value.
• hal_led_set(FAULT_LED, on) — a mock that records the last state (spy), so the test can read it back. Refactored:

void safety_check(void) {
    bool over = hal_adc_read(ADC_TEMP) > 3000;
    hal_led_set(FAULT_LED, over);
}

Boundary: the branch flips between code $3000$ (LED off, > is false) and $3001$ (LED on). So the separating boundary sits between 3000 and 3001. Two tests (cover both branches + boundary):

// branch 1: below/at threshold -> LED off
mock_set_adc(ADC_TEMP, 3000); safety_check(); assert(mock_led == 0);
// branch 2: above threshold -> LED on
mock_set_adc(ADC_TEMP, 3001); safety_check(); assert(mock_led == 1);

Picking 3000 and 3001 (not 0 and 4095) tests the decision, which is where bugs live.

Host tests gate every commit because they are ~hundreds of times faster (Ex 3.3) and debuggable; HIL runs nightly on the shared rig because it is slow and hardware-limited.

(a) Response time is a delta of the two edges: $t_1-t_0=48.500-40.000=8.500\text{ms}.$ (b) $8.5\text{ms}<10\text{ms}$ → PASS, margin $=10-8.5=1.5\text{ms}$. (c) Stuck-high ADC → the DUT believes throttle is at max code 4095 forever → compute_pwm returns the cap 1000 tenths = 100% duty (from Ex 2.3). It never drops below 5%, so the while(pwm > 5.0) loop spins forever → the test times out / fails — which is the correct result: the firmware has no independent way to detect the frozen sensor. Insight: host tests verify the control math; plain HIL verifies timing on real hardware; HIL + fault injection verifies safety behaviour under broken hardware. Only the combination exposes that a stuck sensor drives the motor to full power — the most dangerous, most real-world failure of the three.

(a) Lines to cover $=0.80\times 800=640$. Tests needed $=\lceil 640/12\rceil =\lceil 53.33\rceil =54$ host tests. (b) Host time $=54\times 3\text{ms}=162\text{ms}=0.162\text{s}$. (c) HIL time $=3\times 4\text{s}=12\text{s}$. Total $=0.162+12=12.162\text{s}$. (d) The gate runs only the host tier: $0.162\text{s}<2\text{s}$ budget → sane, gate on host. The 12 s of HIL runs nightly, not per-commit. This is exactly the two-tier split from Ex 4.2, now quantified.

Full-scale code of a 12-bit ADC ::: 4095 (that is $2^{12}-1$, counting from 0) Why can't host tests measure ISR latency ::: host mocks time, so real elapsed duration has no meaning; only real hardware has a real clock Latency from two logic-analyzer timestamps ::: response edge minus trigger edge (a difference, never a single stamp) Which tier gates every commit and why ::: host unit tests — hundreds of times faster and easy to debug Where do you place threshold boundary tests ::: just below and just above the threshold, not at the extremes